[j-nsp] mSyslog + Juniper logs
rszarecki at gmail.com
Thu May 18 03:17:39 EDT 2006
The explicit priority is a hack, which is not always neccessery. Syslog
packet looks like:
<2B Facility><1B Priority><sender IP address><Timestamp><MESSAGE>.
The "explicite-prioryty" insert string into message which is redundant to
first 3 Bytes of Syslog packets.
Your mSyslog has to be able to understand 1st 3B of packet by force of RFC.
Parsing of MESSAGE is not required by any standard. Whole Message is just
string, and Syslog is not intendednt to do any operation on message.
However some syslog server (e.g. syslog-ng 1.6 ) can do a little with this.
From: juniper-nsp-bounces at puck.nether.net
[mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of Erdem Sener
Sent: 17 May 2006 10:02
Subject: [j-nsp] mSyslog + Juniper logs
Anyone actively using mSyslog with mysql as syslog server for Juniper
Reason I'm asking is that mSyslog cannot parse 'facility' and
'priority' fields from Juniper logs, although 'explicit-priority' is
I guess some code hacking is necessary but I'm just too lazy :)
juniper-nsp mailing list juniper-nsp at puck.nether.net
More information about the juniper-nsp